COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-641

DLL Side-Loading

An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

Low

Understand the attack

What is this attack pattern?

An adversary places a malicious version of a Dynamic-Link Library (DLL) in the Windows Side-by-Side (WinSxS) directory to trick the operating system into loading this malicious DLL instead of a legitimate DLL. Programs specify the location of the DLLs to load via the use of WinSxS manifests or DLL redirection and if they aren't used then Windows searches in a predefined set of directories to locate the file. If the applications improperly specify a required DLL or WinSxS manifests aren't explicit about the characteristics of the DLL to be loaded, they can be vulnerable to side-loading.

Requirements

What does the attack require?

Prerequisites

  • The target must fail to verify the integrity of the DLL before using them.

Skills required

  • High: Trick the operating system in loading a malicious DLL instead of a legitimate DLL.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Execute Unauthorized CommandsBypass Protection Mechanism

Affected scopes: Integrity

Defence

How is it prevented and mitigated?

1
Prevent unknown DLLs from loading through using an allowlist policy.
2
Patch installed applications as soon as new updates become available.
3
Properly restrict the location of the software being used.
4
Use of sxstrace.exe on Windows as well as manual inspection of the manifests.
5
Require code signing and avoid using relative paths for resources.